Updated November 2026
Key Takeaways
- This cyber security checklist covers five basics you can check in about five minutes: passwords and MFA, updates, backups, phishing awareness and access controls. Five minutes is enough to find the gaps, not to close them.
- Score yourself by counting the areas where you can tick every box. Each area has a plain-language fix if you cannot.
- Software updates matter more than ever: in Verizon’s 2026 report, exploited vulnerabilities were the most common known way into a breach.
- Small businesses are a real target. About 96% of ransomware victims with a known size in Verizon’s 2026 report were small or mid-sized businesses.
- You can print the checklist or save it as a PDF and run it again every month.
Most security gaps are not exotic. They are an account with no multi-factor authentication, a laptop that missed its updates or a backup nobody has ever tried to restore. Each one is easy to fix once you know it is there.
This cyber security health check is built for owners and managers who want to find those gaps without hiring a consultant or learning technical jargon. It is a simple cyber security checklist: five areas, a quick score and a clear next step for every gap. If you have ever wondered how to check whether your business is secure online, start here.
What Every Business Should Know About a Cyber Health Check
Why Run a Cyber Health Check?
Attackers rarely pick a business by name. Most attacks are automated and look for whatever is easy to get into, and smaller companies often have fewer protections in place. The most recent data shows why a regular cyber health check is worth the few minutes:
Breaches are expensive. IBM’s 2026 Cost of a Data Breach Report puts the global average cost of a breach at $4.99 million, and the U.S. average at $11.5 million (IBM).
Ransomware is common, and small businesses are hit often. Ransomware appeared in 48% of the breaches in Verizon’s 2026 Data Breach Investigations Report, and where company size was known, about 96% of ransomware victims were small or mid-sized businesses (Verizon DBIR 2026).
Unpatched software is now the leading way in. In the breaches where attackers broke in (setting aside errors and misuse), Verizon found that exploiting software vulnerabilities was the most common known entry point at 31%, up from 20% the year before, and ahead of stolen credentials at 13%. That is why updates sit near the top of the checklist.
A cyber health check will not solve everything. It does show you where you stand, so a small oversight does not turn into a major incident. For a broader introduction, read what cybersecurity is and how businesses protect themselves, or see our guide to cybersecurity for small businesses.
The Cyber Security Checklist: A 5-Minute Check of the Basics
Silverback Consulting · (719) 452-2205 · silverbackconsulting.us
Read each statement and tick it only if you are confident it is true today. If you are not sure, leave it unticked and count it as a no. Not knowing is a gap in itself. Your score updates as you go.
1. Passwords and MFA
If you answered no to any of these: turn on MFA for email and online banking first, then for admin and cloud accounts. Move saved and shared passwords into a business password manager so staff stop reusing them.
2. Software and system updates
If you answered no to any of these: switch on automatic updates, pick a monthly day to confirm everything installed, and replace any system that no longer receives security updates. Attackers scan for known, unpatched holes, so this fix has the biggest payoff.
3. Data backups
If you answered no to any of these: automate daily backups of your key systems and follow the 3-2-1 rule: three copies, on two types of storage, with one kept offline or immutable. Then put a test restore on the calendar twice a year. A backup you have never restored is only a hope.
4. Phishing and cybersecurity awareness
If you answered no to any of these: run a short training session and set up one easy way to report suspicious messages, such as a shared mailbox or a report button. Teach people to verify unusual requests for money, gift cards or password resets by calling the sender, not to hunt for typos. Phishing emails written with AI are often flawless.
5. Access controls and permissions
If you answered no to any of these: list who can open your most sensitive folders and remove anyone who does not need access. Write a short offboarding checklist so accounts are disabled the day someone leaves, and review access every quarter.
Your score
Tick the items you can answer yes to. Your score appears here.
What your score means
Count each area where you could tick every box. The score is out of five.
| Areas covered | What it means | Where to start |
|---|---|---|
| 4 to 5 | You have a strong foundation. | Re-run this check monthly, work through the bonus items below and consider a full assessment to find what a quick check cannot. |
| 2 to 3 | You have real gaps worth closing this month. | Fix MFA and updates first, then backups. The Cyber Hygiene Questionnaire goes deeper. |
| 0 to 1 | Your business is easier to attack than it needs to be. | This week: MFA on email, automatic updates on and one confirmed backup. Then talk to an IT provider about a full assessment. |
After the Checklist: Next Steps and Bonus Basics
What to Do If You Find a Problem
If the checklist turned up gaps, don’t panic. Most businesses have some, and the next step matters more than the score. Here is the order we recommend:
Start with the quick wins. Turning on MFA and installing outstanding updates takes minutes and blocks some of the most common ways in.
Verify your backups. Confirm that a recent copy exists and that you can restore it.
Talk to your IT provider, if you have one. Share your results and ask them to close the gaps and confirm the fixes.
Take the next step in depth. The Cyber Hygiene Questionnaire covers more ground, and a cyber risk assessment maps your specific exposure with expert guidance.
Brief your team. Even a 30-minute lunch-and-learn on phishing helps, and it makes security a shared habit instead of one person’s job.
Run this cyber health check monthly. Setting a calendar reminder is the easiest way to keep up the habit.
The four bonus items below are not part of the five-area score, but each one makes a bad day much easier to handle.
An incident response contact
If something goes wrong at 8 p.m. on a Friday, who do you call? Keep a one-page list with your IT provider or security partner, your cyber insurer, your bank and legal counsel. Make sure more than one person knows where it is. Cyber crime can also be reported to the FBI’s Internet Crime Complaint Center at ic3.gov.
Email security
Email is a common way for attackers to reach your staff. Confirm you have spam and phishing filtering, and ask your IT provider whether your domain has SPF, DKIM and DMARC set up, which makes it harder for criminals to send convincing emails that appear to come from you.
Device encryption and a lost-device plan
A lost laptop should be an inconvenience, not a data breach. Check that company laptops and phones are encrypted and that you can lock or wipe a device remotely.
Cyber insurance
If you have a policy, read what it covers and what it requires. Insurers often ask for controls such as MFA and tested backups, and a claim can be disputed if your application overstated the controls you had in place.
Cyber Security Checklist FAQs
What is a basic cyber security checklist for businesses?
A basic cyber security checklist covers the essentials: strong, unique passwords with multi-factor authentication, up-to-date software, tested backups, phishing awareness training and tight control over who can access what. It is a quick way to see where your business is exposed.
How can I do a cyber security health check without an IT team?
Use the Cyber Health Checklist below. It is written for non-technical readers: tick what you are sure is true, count the rest as gaps and follow the fix under each area. For anything you cannot confirm yourself, such as whether a backup is truly restorable, ask whoever manages your systems or an outside IT provider.
How often should I run a cyber health check?
We suggest running this quick check monthly and a full assessment at least once a year, or after major changes such as a new system, a new vendor or staff turnover.
What are the minimum cybersecurity requirements for small businesses?
At a minimum, use strong passwords with multi-factor authentication, keep all systems and software updated, back up your data offsite or in the cloud, train employees to recognize phishing and limit access to sensitive information to the people who need it. These foundations reduce risk significantly, and some industries add legal requirements on top, such as HIPAA for healthcare.
What is the most common way attackers get in?
In Verizon’s 2026 report, exploiting software vulnerabilities was the most common known way into a breach, at 31%, ahead of stolen credentials at 13%. Phishing and stolen passwords are still common, which is why training and MFA stay on the checklist, but it makes keeping systems updated even more important.
What does a regular cybersecurity checkup help identify?
Routine checkups reveal outdated software, unused or former-employee accounts, missing multi-factor authentication, untested backups and misconfigured systems. These are common gaps that attackers look for.
Want Help Closing the Gaps?
A checklist shows you where the gaps are. Silverback Consulting helps small and growing businesses fix them with practical, layered protection, without the complexity. Take the questionnaire for a deeper look, or talk to us about a full assessment.